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SUPPLEMENTAL APPEAL BRIEF UNDER 37 C.F.R. § 41.37 

In support of the Notice of Appeal filed on August 22, 2008, and pursuant 
to 37 C.F.R. § 41.37, and the Notice of Non-compliance, Appellants present this 
supplemental appeal brief in the above-captioned application. 

This is an appeal to the Board of Patent Appeals and Interferences from 
the Examiner's final rejection of claims 4-23 in the Final Office Action dated June 4, 
2008. The appealed claims are set forth in the attached Claims Appendix, 

Appellants update the headings of § §6 and 7 to include the listing of all 
claims so that the '^grounds of rejection to be reviewed'* cites "the same rejection as 
present in the final office action." Appellants further add a third section relating to the 
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dependeni claims for the purpose of seeking full compliance with vague notation given 

for the original notice of non-compliance, wherein the originally filed Appeal Brief did 

cite the same rejection as the final office action relating to the Independent claims. 

1. Real Party in Interest 

This application was assigned to Micromiise Inc., which was acquired by 
International Business Machines Corporation, the real party in interest. 

2. Related Appeals and Interferences 

There are no other appeals or interferences which wonld directly affect, be 
directly affected by, or have a bearing on the insiant appeal. 

3. Status of Claims 

Claims 1-3 have been cancelled. Claims 15-23 stand finally rejected under 35 
U.S.C. §101. Claims 4-23 stand finally rejected under 35 U.S.C. §102(e). The final 
rejections ot claims 4-23 is being appealed. 

4. Status of Amendments 

All amendments submitted by the Appellant have been entered. 

5. Summary of Claimed Subject Matter 

Claim 4 recites a metliod for handling network events generated in a network in 
an enterprise, (see, for example, page 3, line 15 - page 4, line 1). The method comprises 
detecting at least one of a plurality of network events, (see, for example, page 12, lines 
5-9). The method comprises executing an action tree in response to the network event, 
the action tree including instructions based on relationships between enterprise-related 
data objects, (see, for example, page 12, lines 10-16, page 12, line 22 - page 13, line 7). 
The relationships defined by at least one data impact analysis data structure are populated 
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with data accessed from a plurality of data sources throughout the network, (see, for 

example, page 4, lines 17-22, page 7, line 2 - page 8, line 2). 

Claim 1 5 recites an apparatus for handling network events generated in a network 

in an enterprise, (see, for example, Fig. I, page 3, line 1 5 - page 4, line 1). The apparatus 

comprises an event broker operative to detect at least one of a plurality of network events. 

(see, for example. Fig. 1 element 1 14, page 12, lines 5 - 9). The apparatus comprises an 

impact server operative to execute an action tree in response to the network event, the 

action tree including instructions based on relationships between enterprise-related data 

objects, (see, for example, Fig 1 element 100, page 12, lines 10-16, page 12, line 22 - 

page 13, line 7) The relationships defined by at least one impact analysis data structure 

are populated with data accessed from a plurality of data sources throughout the network. 

(see, for example, page 4, lines 1 7-22, page 7, line 2 - page 8, line 2). 

6. Grounds of Rejection to be Reviewed on Appeal 

I. The rejection of claims 15-23 under 35 U.S.C, §101 is improper 
because the claims properly recites statutory subject matter. 

II. The rejection of claims 4-10 and 15-20 under 35 U.S.C. S102(e) is 
improper because U.S. Patent No. 6^470.384 (Q^Brien) fails to identically disclose ail 
of the claimed limitations. 

TIT The rejection of claim 1 1-14 and 21 -23 under 35 U.S.C. SlQ3(a> is 
improper because Q^Brien, in combination with U.S. Patent No. 6 J08,820 (^Tarli") 
fails to teach or suggest aii of the recited limitations. 

7. Argument 

1. The rejection of claims 15-23 under 35 U.S.C. SlOl is improper 
because the claims properly recites statutory subject matter.. 
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The rejection of claim 15 under 35 U.S.C. § 101 is improper because the claim 

properly recites statutory subject matter. 

Claim 15 was finally rejected under 35 U.S.C. §101 as being "directed to non- 
statutory subject matter." Appellants respectfully disagree and submit the Examiner's 
reasoning and legal support is flawed. 

The Examiner states that "the specification leads to the conclusion that the 
apparatus of the claimed invention may be implemented in software" and that "software 
fails to fall into one of the four statutory classes of invention: process, machine, 
manufacture, or composition of matter." First off, the Examiner overlooks the exact 
language of claim 15 which recites "An apparatus . comprising ... an event broker ... 
and an impact server. ' The event broker 1 14 of Fig. 1 is described in the specification as 
a "module that provides for real time event processing." The impact server 100 of Fig. 1 
is described as being within the "logic layer." 

Pursuant to 35 U.S.C. § 1 12, ^[1, the specification "shall contain a written 
description of the invention ... as to enable any person skilled in the art to which it 
pertains." It is recognized by one skilled in the ai1, as per the standard under 35 U.S.C. 
§ 1 1 2, ^1 , that a module is implemented in a processing device and the logic layer is also 
a physical processing device physically performing processing operations. 

In the final Office Action dated June 4, 2008 on pages 2-3, the Examiner states a 
failure "to see how a module and a server in the logical layer are statutory embodiments 
and not software as previously discussed. A software module and a logical server are 
not statutory embodiments as defined under 35 U.S.C. 101." Appellants respectfully 
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disagree because the Examiner overtly includes descriptive terminology outside of the 

exact langaage of the claims . 

The Examiner refi^ to "a software module" and "a logical server," whereas 
claim 15 recites "an event broker'* and "an impact server." 

For example, the specification describes the impact server 100 including two 
processors 116, 1 18, as well as a two databases 102 and 120 (see, for example. Fig. 1). 
The Examiner's intopretation and assertion that the "impact server" is a logical server 
and in-fact merely software is in direct contradiction to the exact disclosure of the 
specification, as well as in direct contradiction to the Examination standard under 35 
U.S.C §112,111. 

The specification also refers to the event broker as a 'Snodule that provides for 
real time event processing," where again under the 35 U.S.C. § 1 12, ^fl standard, it is 
understood that software does not and cannot exist in vacuum. Rather, the description of 
providing for real-time event processing requires a physical processing component for 
the performance of this operation, again fully consistent with the Examination standard 
under 35 U.S.C. §112, ^1. 

Hence, Appellants submit this rejection is improper because claim 15, and hence 
claims 16-23 as well, fall within a statutory subject consistent with 35 U.S.C. §101 . 

IL The rejection of claims 4-10 and 15-20 under 35 U.S.C. §102(e) is 
improper because U.S. Patent No. 6^470.384 (O'Brien) faMs to identically disclose all 
of the claimed limitations. 

Claims 4 and 15 stand finally rejected under 35 U.S.C. § 1 02(e) as being 
anticipated by U.S. Patent No. 6,470,384 (O'Brien). Appellants respectfully disagree and 
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submit this rejection is improper because O'Brien fails to identically disclose all of the 

claimed limitations, 

O'Brien describes a multi-computer network that includes action sets for the 
performance of various activities, t>pically security activities, in response to detected 
network events under the Smiple Network Management Protocol (SNMP). Agents 6 
generate network events 7 and a manager 25 (also known as the arbiter 8) maps the 
network events to actions 32. These actions are then performed by the actors 9. (col. 4, 
hnes 35-39). Network events are generally defined as any type of "state or condition" 
Uiat can "be monitored and reported to the arbiter 8." (col. 4, lines 39-41). In response to 
the event notification, the manager "determines the set of actions to which the network 
event 7 is associated using a stored set of event mappings." (col. 4, line 65 - col. 5, line 
2). O'Brien further describes that network includes active security features by scanning 
agents scanning the network and if security issues are detected, certograms are provided 
to the manager 25, where certograms are "specialized messages." 

Claims 4 and 1 5 recites the execution of the action tree "in response to the 
network event, the action tree including instructions based on relationships between 
enterprise-related data objects, the relationships defined by at least one data impact 
analysis data structure populated with data accessed from a plurality of data sources 
throughout the network." 

Among other shortcomings, Appellants submit that O'Brien fails to identically 
disclose the claimed "action tree" where the action tree includes "instructions based on 
relationships" as claimed including the "relationships defined by at least one data 
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impact analysis data structure populated with data accessed from a pluraJitjr'^ of data 
sources through the network." 

O'Brien describes manager 25 accessing the stored set of event mappings (col. 4, 
line 66 - col. 5. line 5) and the active security agent 23 scanning the network and 
notifying the manager 25 of any vulnerabilities (col. 5, lines 19-24), These passages, as 
well as O'Brien in general, do not provide the claimed "relationships" as O'Brien does 
not generate instructions that are based on relationships defined by at least one data 
impact analysis data structure populated with data access fcom a plurality of data sources. 

Among other deficiencies, O'Brien does not include ''data impact analysis data 
structure" where this "data structure'* is ''populated with data accessed from a plurality of 
data sources." Rather, at best, the manager 25 of O'Brien can, in response to the 
certograms 30, generate an action set to be taken by, in this example, a firewall 17, (col. 
6, lines 47-50). 

On page 4 of the final Office Action dated June 4, 2008, the Examiner asserts that 
under O'Brien, "mapping network events to appropriate actions is defining relations." 
Appellants respectfii] ly disagree and submit this overlooks the exact claim language as 
recited, which includes that *'the relationships defined by at least one data impact analysis 
data strucmrej" the relationships are **between enterprise-related data objects." The 
Examiner-cited passages provide for the arbiter 8 to map events 7 to actions 32, where 
the events are "any type of stale or condition which could be monitored and reported" 
and actions are functions the system can perform. In other words, the O'Brien system 
merely maps a system function to a device that can perform that fiinction. This is 
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inconsistent with 'Yelationships bervv^een enterprise-related data objects" and does not 

disclose the "data impact analysis data structure.'* 

Tlie shortcomings of O'Brien are fijrther emphasized where in the Final Office 
Action, page 4, the Examiner further asserts that O'Brien discloses the data impact 
anaiysis data structure is populated with data accessed from a plurality of data sources 
throughout the network. The Examiner cites to col. 5, lines 19-24, which describes the 
generation of certograms by scanning the system. As noted above, certograms are 
"specialized messages," where these message relate to any detected vulnerabilities. *The 
active security scanner agent 23 proactively analyzes the security and integrity of the 
network and reports any vulnerabilities . . . using specialized messages known as 
certograms 30." (Col. 5, lines 19-24). Ihese certograms report system vulnerabilities, 
which is wholly inconsistent with populating a data structure with data accessed from a 
plurality of data sources. There is no disclosure within O'Brien and it is inconsistent with 
O'Brien and the security operations to use these certograms to populate a data structure 
that defines relationships between enterprise-related objections. Rather, the certograms 
are notifications that warrant the manager to perform a particular activity. 

The Examiner further cites to col. 7, lines 20-24 and lines 46-54. These passages 
describe SNMP traps, which includes an event mapping being referenced by object 
identifiers (OID). The event mapping even includes referencing additional actions. 
Appellants again assert this overlooks the exact language of claims 4 and 15, which recite 
"the relationships defined by at least one data impact analysis data structure populated 
with data accessed from a plurality^ of data sources throughout the network ." (emphasis 
added). The event mappings do not identically disclose the population of the data 
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structure with data accessed from a plurality of data sources, rather the event mappings of 

O'Brien include directions for the performance of a security operation and who may 

perform the operation. Event mappings are absolutely silent regarding data being 

accessed from a plurality of data sources and in fact O'Brien does not "populate" any 

data structure, rather uses a define roadmap for the performance of an "action set 39" in 

response to "a network event 7," where the action set includes ''at least one action 32," 

Accordingly, Appellants respectfully submit that O'Brien does not identically 

disclose the claimed limitations recited in claims 4 and 15 (as well as dependent 

claims 5-14 and 16-23), and therefore the present rejection is improper. 

III. The reiection of claim 11-14 and 21-23 under 35 U.S.C, S103(a) is 
improper because O'Brien, in combination with U,S. Patent No. 6 J08,820 ("Park") 
fails to teach or suggest aU of the recited Kmitatlons. 

Claims 1 1-14 and 21-23 stand finally rejected under 35 ILS.C. §103(a) as being 
unpatentable over O'Brien in view of U.S. Patent No. 6,708,820 CTark). Appellants 
respectfully disagree and submit this rejection is improper because O'Brien in 
combination with Park fails to teach or suggest all of the recited limitations. 

For the sake of brevity, Appellants resubmit the above-offered position regarding 
the noted deficiencies of O'Brien. Park is not asseiled to overcome these deficiencies^ 
but rather is asserted regarding farther recited limitations of claims 11-14 and 21-23, 
hence failing to correct the fatal deficiencies of O'Brien when asserted for teaching or 
suggesting the recited limitations. 

Accordingly, Appellants respectfully submit the rejection is unproper. 
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Conclusions 



For the reasons set forth above, Appellant respectfully requests that the Board 
reverse the final rejections of the claims by the Examiner under 35 U.S.C. § 101, §102(e) 
and §103 (a) and indicate that claims 4-23 are allowable. 



Dated: November 21, 2008 



THIS CORRESPONDENCE IS BEING SUBMITTED 
ELECTRONICALLY THROUGH THE PATENT AND 
TRADEMARK OFFICE EFS FILING SYSTEM ON 
November 21, 200». 




/Timothy J. Bechen 
Reg. No. 48,126 

DREIERLLP 
499 Park Ave. 

New York, New York 10022 
Tel: (212) 328-6100 
Fax:(212)328-6101 



Customer No, 61834 
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Claims Appendix 

1.-3. (Cancelled) 

4. (Previously Presented) A method for handling network events generated in a 
network in an enterprise, the method comprising: 

detecting at least one of a plurality of network events; and 

executing an action tree in response to the network event, the action tree including 
instructions based on relationships between enterprise-related data objects, the 
relationships defined by at least one data impact analysis data structure populated with 
data accessed from a plurality of data sources throughout the network. 

5. (Previously Presented) The method of claim 4 further comprising: 
identifying a workstation affected by the detected network event; 
deteimining at least one administrator and at least one business unit affected by 

the network event; and 

contacting the at least administrator regarding the dd:ected network event. 

6. (Previously Presented) The method of claim 5, wherein the step of 
determining at least one administrator and at least one business unit includes the 
determination being made by traversing the impact data analysis data structure. 

7. (Previously Presented) The method of clami 4, wherein the execution of the 
action tree is performed by a policy engine. 

8. (Previously Presented) The method of claim 4, wherein the enterprise-related 
data objects include organization nodes that define the organization structure of the 
enterprise. 

9. (Previously Presented) The method of claim 8, wherein the organizational 
structures include at least one of: a host, a communication device, a user and a document 
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10. (Previously Presented) The method of claim 8 further comprising: 

accessing the enterprise-related data objects through a networked database. 

11. (Previously Presented) The method of claim 4 forther comprising: 
hibernating the action tree, including saving a current state of the action tree to a 

state database. 

1 2. (Previously Presented) The method of claim 1 1 , wherein the state database is 
mihin an impact server. 

13. (Previously Presented) The method of claim 1 1 further comprising: 

awakening the action tree from a hibernated state in response to a wakeup call 
message. 

14. (Previously Presented) The method of claim 13, wherein the wakeup call 
message is an electronic mail message. 

1 5. (Previously Presented) An apparatus for handling network events generated 
in a network in an enterprise, the apparatus comprising: 

an event broker operative to detect at least one of a plurality of network events; 

and 

an impact server operative to execute an action tree in response to the network 
event, the action tree including instructions based on relationships between enterprise- 
related data objects, the relationships defined by at least one impact analysis data 
structure populated with data accessed from a plurality of data sources throughout the 

network, 

16. G^rcviously Presented) The apparatus of claim 15, wherein the impact server 
is further operative to idaitify a workstation affected by the detected network event, 
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determine at least one administrator and at least one business unit affected by the network 
event and contact the at least administrator regarding the detected network event. 

17. (Previously Presented) The apparatus of claim 15 further comprising: 

a policy engine disposed within the impact server, wherein the execution of the 
action tree is performed by the policy engine. 

18. (Previously Presented) The apparatus of claim 17, wherein the enterprise- 
related data objects include organization nodes that define the organization structure of 
the enterprise. 

19. (Previously Presented) The apparatus of claim 18, wherein the organizational 
structures include at least one of: a host, a communication device, a user and a document, 

20. (Previously Presented) The apparatus of claim 15 fuiiher comprising; 

a networked database having the enterprise-related data objects stored therein, 
such that accessing the enterprise-related data objects through a networked database. 

21. (Previously Presented) The apparatus of claim 1 5 further comprising: 
a state database; and 

the impact server is fiirther operative to hibernate the action tree, including saving 
a current state of the action tree to the state database. 

22. (Previously Presented) Theapparatusof claim 21, wherein the impact server 
is furth^ operative to awaken the action tree from a hibernated state in response to a 
wakeup call message. 

23. (Previously Presented) The apparatus of claim 22, wherein the wakeup call 
message is an electronic mail message. 
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Evidence Appendix 
No evidence has been submitted or relied upon in the instant appeal. 



{00409n3.DOC;} 



14 



Serial No. 10/756,843 
Attorney Docket No.: 500323.002 

IBM Ref: AUS20065001US2 

Related Proceedings Appendix 
Tliere are no related proceedings which are related to or would have a bearing on 
the instant appeal. 
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